s2s: checkCertificate
s2s: actually checkCertificate()